Support `if-modified-since` headers for API requests

[sbrinkhorst]

Describe the bug
The API headers say the if-modified-since header is supported:
access-control-allow-headers: Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since

In practice I don't see this for both the index and json API's, for both of them I get a 200 for libraries that are unlikely to have been changed since the provided timestamp.

Expected behavior

If the data has not been modified, I expect to get a 304 response.

Example from another API:

curl --head -H "If-Modified-Since: Mon, 04 Aug 2025 14:17:44 GMT" https://index.crates.io/ba/se/base64

To Reproduce
Example for beautifulsoup4, which was last changed in April.

curl --head -v -H "Accept: application/vnd.pypi.simple.v1+json" -H "If-Modified-Since: Mon, 04 Aug 2025 14:17:44 GMT" https://pypi.org/simple/beautifulsoup4/

curl --head -v -H "Accept: application/json" -H "If-Modified-Since: Mon, 04 Aug 2025 14:17:44 GMT" https://pypi.org/pypi/beautifulsoup4/json

My Platform
I'm using curl 8.7.1 on my mac (Sequoia 15.5)

curl 8.7.1 (x86_64-apple-darwin24.0) libcurl/8.7.1 (SecureTransport) LibreSSL/3.3.6 zlib/1.2.12 nghttp2/1.64.0
Release-Date: 2024-03-27
Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns ldap ldaps mqtt pop3 pop3s rtsp smb smbs smtp smtps telnet tftp
Features: alt-svc AsynchDNS GSS-API HSTS HTTP2 HTTPS-proxy IPv6 Kerberos Largefile libz MultiSSL NTLM SPNEGO SSL threadsafe UnixSockets

Additional context
I noticed that the responses from the API are also lacking the last-modified header, maybe that is related.

[di]

We permit the If-Modified-Since header via CORS but I'm not sure if we actually have ever supported using it for API requests.

FWIW, this does work for file requests:

curl -s -o /dev/null -w "%{http_code}\n" -z "Wed, 06 Aug 2025" https://files.pythonhosted.org/packages/20/16/650289cd3f43d5a2fadfd98c68bd1e1e7f2550a1a5326768cddfbcedb2c5/pip-25.2.tar.gz
304

$ curl -sI https://files.pythonhosted.org/packages/20/16/650289cd3f43d5a2fadfd98c68bd1e1e7f2550a1a5326768cddfbcedb2c5/pip-25.2.tar.gz | grep last-modified
last-modified: Wed, 30 Jul 2025 21:50:17 GMT

[sbrinkhorst]

Our goal is to find out if there are updates available, not download the actual files. It is not blocking for us, as we can also download the entire json file to find out. We mostly want to use these headers to be as least intrusive as we can be.